Regulon — OK-HB-1275 · OK HB 1275 (Social Media Minors)

WHAT THIS BILL REGULATES · 3 REQUIREMENT TYPES

How Is This Bill Enforced

Enforcement Authority

Attorney General enforcement. The Attorney General may initiate enforcement actions against social media companies that violate the act. Violations of the data-practices provisions (Section 4) may be reported to the Office of the Attorney General, which must send notice to the platform and provide a 45-day cure period before further enforcement. Social media companies are also liable to individuals for statutory penalties or damages, suggesting a private right of action.

Private Right of Action

private right of action.

Penalties

A social media company that violates the act is liable to an individual for either (1) $2,500 per violation plus court costs and reasonable attorney fees, or (2) actual damages resulting from a minor accessing a social media platform without parental consent, plus court costs and reasonable attorney fees. Commercial entities that knowingly retain age-verification identifying information beyond the permitted period are liable for actual damages plus court costs and reasonable attorney fees. A safe harbor from liability exists where the platform performed reasonable age verification and the minor gained access through fraud, including use of fake identification.

Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.

Statutory Text

Analysis & Obligations

Section 1 (noncodified)

Legislative intent

In recognition of the critical role social media plays in the lives of minors and its impact on their mental well-being, this Legislature is committed to safeguarding the youth from accessing platforms that have demonstrated adverse effects on their mental health due to the addictive elements found in social media and the targeting of minors through the use of algorithms by social media platforms. This Legislature's intent is not to censor content found on social media platforms, but rather to prevent access by persons who have not yet reached an age to handle the negative aspects of social media. Much like our historical commitment to curbing the use of addictive substances and behaviors among minors, such as laws regulating the use of intoxicants and gambling, this Legislature now takes proactive measures to address the emerging challenges posed by social media platforms.

Section 1 is a noncodified statement of legislative intent. It frames the bill as a public-health measure aimed at protecting minors from the addictive elements of social media and algorithmic targeting, drawing an analogy to existing laws regulating minors' access to intoxicants and gambling. It creates no operative obligations.

25 O.S. § 120

Savings clause and definitions

(A) Nothing in this act shall be construed to limit the content found on social media platforms or prohibit minors from posting content on other platforms, digital or otherwise, that they legally have access to.

(B) As used in this act: 1. "Account holder" means an individual who creates an account or a profile to use a social media platform; 2. "Commercial entity": a. means a corporation, limited liability company, partnership, limited partnership, sole proprietorship, or other legally recognized entity, and b. includes a third-party vendor; 3. "Dark pattern" means a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decision making, or choice and includes, but is not limited to, any practice the Federal Trade Commission refers to as a dark pattern; 4. "Digitized identification card" means a data file available on a mobile device that has connectivity to the Internet through a state-approved application that allows the mobile device to download the data file from the Oklahoma Department of Public Safety that contains all of the data elements visible on the face and back of a driver license or identification card and displays the current status of the driver license or identification card, including valid, expired, canceled, suspended, revoked, active, or inactive; 5. "Fake identification" means identification which has been fabricated or altered to misrepresent the age of the person using it for age verification that cannot be detected through reasonable efforts, taking into account available technology; 6. "Minor" means an individual under eighteen (18) years of age; 7. "Oklahoma user" means an individual who is a resident of the State of Oklahoma and who accesses or attempts to access a social media platform while present in this state and whose location out of this state is not assumed based only on the registered location of the Internet protocol address associated with the user; 8. "Personal information" means information that is linked or reasonably linkable to an identified or identifiable minor, including biometric information and unique identifiers to the minor; 9. "Reasonable age verification" means to confirm that a person seeking to access a social media platform is at least eighteen (18) years of age; 10. "Social media company" [full definition]; 11. "Social media platform" [full definition]; 12. "Substantial harm or privacy risk to minors" [full definition]; 13. "User" means a person who has access to view all or some of the posts and content on a social media platform but is not an account holder.

Section 120 opens with a savings clause clarifying that the act does not limit content on social media platforms or prohibit minors from posting content on other platforms they legally have access to. The remainder of the section establishes the definitions used throughout the act, including key terms such as social media company, social media platform, minor, dark pattern, and reasonable age verification.

The social media platform definition is notably narrow: it requires the service to employ algorithms that analyze user data to select content, feature infinite scrolling, and have a substantial social-interaction function. A $100 million U.S. annual gross revenue threshold further limits scope. Extensive carve-outs exclude email, messaging, streaming, gaming, e-commerce, news, cloud storage, educational, and professional networking services.

25 O.S. § 121

Minor account restrictions, parental consent, and age verification

Deployer

(A) 1 A social media company shall not permit an Oklahoma user who is a minor less than sixteen (16) years of age to be an account holder on a social media company's social media platform.

(B) 2 A social media company shall not permit an Oklahoma user who is a minor of sixteen (16) or seventeen (17) years of age to be an account holder on the social media company's social media platform unless the minor has the express consent of a parent or legal guardian.

(C)(1)–(2) 3 1. A social media company shall verify the age of an account holder. 2. If an account holder is a minor of sixteen (16) or seventeen (17) years of age, the social media company shall confirm that the minor has consent under subsection B of this section to become a new account holder at the time the Oklahoma user opens the account.

(D)(1)–(2) 3 1. A social media company may use a third-party vendor to perform reasonable age verification before allowing access to the social media company's social media platform. 2. Reasonable age verification methods under paragraph 1 of this subsection include providing: a. a digitized identification card, including a digital copy of a driver license, b. government-issued identification, c. any commercially reasonable age verification method, or d. confirmation from a platform from which social media applications are downloaded that the platform has verified the age of the user.

Section 121 establishes the bill's core access-restriction framework. Subsection A imposes an outright ban on social media accounts for Oklahoma minors under age 16. Subsection B permits 16- and 17-year-olds to hold accounts only with express parental or guardian consent. Subsection C requires social media companies to verify every account holder's age and, for 16- and 17-year-old minors, to confirm parental consent at the time the account is opened.

Subsection D authorizes the use of third-party vendors for age verification and enumerates acceptable methods: digitized ID, government-issued ID, any commercially reasonable method, or confirmation from an app-distribution platform that has verified the user's age. This flexibility gives platforms latitude in implementation while preserving the verification mandate.

Compliance actions 3 items

Social media companies must prohibit Oklahoma minors under 16 from holding accounts on their social media platforms.

MN-01.11

Social media companies must obtain express parental or guardian consent before permitting an Oklahoma minor aged 16 or 17 to hold an account on their social media platform.

MN-01.2

Social media companies must verify the age of every account holder using a reasonable age verification method and, for 16- and 17-year-old minors, must confirm parental consent at the time the account is opened. Acceptable methods include digitized ID, government-issued ID, any commercially reasonable method, or app-store-level age confirmation.

MN-01.1

25 O.S. § 122

Data practices and privacy protections for minors

Deployer

(A)(1) 4 A social media platform that is accessed by minors shall not: 1. Process the personal information of any minor if the social media platform has actual knowledge of or willfully disregards that the processing may result in substantial harm or is a privacy risk to minors;

(A)(2) 5 2. Profile a minor unless both of the following criteria are met: a. the social media platform can demonstrate it has appropriate safeguards in place to protect minors, and b. (1) profiling is necessary to provide the online service or feature requested for the aspects of the online service or feature with which the minor is actively and knowingly engaged, or (2) the social media platform can demonstrate a compelling reason that profiling does not pose substantial harm or is a privacy risk to minors;

(A)(3)–(4) 6 3. Collect or retain any personal information that is not necessary to provide an online service or feature with which a minor is actively and knowingly engaged unless the online platform can demonstrate a compelling reason that collecting or retaining the personal information does not pose substantial harm or is a privacy risk to minors; 4. Use the personal information of a minor for any reason other than the reason for which the personal information was collected unless the online platform can demonstrate a compelling reason that the use of the personal information does not pose substantial harm or is a privacy risk to minors;

(A)(5)–(6) 7 5. Collect any precise geolocation data of minors unless the collection of the precise geolocation data is strictly necessary for the online platform to provide the service, product, or feature requested and then only for the limited time that the collection of the precise geolocation data is necessary to provide the service or feature; 6. Collect any precise geolocation data of a minor without providing an obvious sign to the minor for the duration of the collection that the precise geolocation data is being collected;

(A)(7) 8 7. Use dark patterns to lead or encourage minors to provide personal information beyond what personal information would otherwise be reasonably expected to be provided for that online service or feature, to forego privacy protections, or to take any action that the online platform has actual knowledge of or willfully disregards that may result in substantial harm or is a privacy risk to minors;

(A)(8) 9 8. Use any personal information collected to estimate the age or age range for any other purpose or retain that personal information longer than necessary to estimate age. The age estimate must be proportionate to the risks and data practice of an online service or feature;

(A)(9) 10 9. Sell or share any personal information or any geolocation data of minors.

(B)–(D) B. Violations of this section may be reported to the Office of the Attorney General. C. If the Attorney General determines that there has been a violation of this section, the Attorney General shall send notice to the social media platform. D. The social media platform shall have a forty-five-day period to cure the violation of this section.

Section 122 imposes a comprehensive set of data-practice restrictions on social media platforms accessed by minors. The restrictions cover harmful processing, profiling, data minimization, purpose limitation, geolocation collection, dark patterns, age-estimation data reuse, and a prohibition on selling or sharing minor personal information or geolocation data. Each prohibition is subject to narrow carve-outs requiring the platform to demonstrate either necessity for the requested service or a compelling reason that the practice does not pose substantial harm or privacy risk to minors.

Enforcement flows through the Attorney General: violations may be reported to the AG's office, which must send notice to the platform and afford a 45-day cure period before further action. This cure period applies only to Section 122 violations, not to the age-verification and account-restriction obligations in Section 121.

Compliance actions 7 items

Social media platforms must not process the personal information of any minor if the platform has actual knowledge of or willfully disregards that the processing may result in substantial harm or is a privacy risk to minors.

D-01

Social media platforms must not profile a minor unless the platform can demonstrate appropriate safeguards are in place and either profiling is necessary for the service the minor is actively and knowingly engaged with or the platform can demonstrate profiling does not pose substantial harm or privacy risk to minors.

D-01

Social media platforms must not (1) collect or retain personal information beyond what is necessary to provide the service or feature the minor is actively and knowingly engaged with, or (2) use a minor's personal information for any purpose other than the purpose for which it was collected, unless the platform demonstrates a compelling reason that the collection, retention, or use does not pose substantial harm or privacy risk to minors.

D-01.4

Social media platforms must not collect precise geolocation data of minors unless strictly necessary for the requested service and only for the limited time necessary, and must provide an obvious sign to the minor for the duration of any geolocation data collection.

D-01.4

Social media platforms must not use dark patterns to lead or encourage minors to provide excess personal information, forego privacy protections, or take any action the platform knows or willfully disregards may cause substantial harm or privacy risk to minors.

CP-01.3

Social media platforms must not use personal information collected for age estimation for any other purpose or retain it longer than necessary to estimate age, and the age estimate must be proportionate to the risks and data practices of the service.

D-01.4

Social media platforms must not sell or share any personal information or geolocation data of minors.

D-01

25 O.S. § 123

Liability, enforcement, exemptions, and safe harbors

Deployer

(A)(1) A social media company that knowingly violates this act is liable if the social media company fails to perform a reasonable age verification or fails to comply with Section 4 of this act.

(A)(2) 11 If a social media company performs a reasonable age verification, the social media company shall not retain any identifying information of the individual after access to the social media platform has been granted.

(B) The Attorney General may initiate an enforcement action against social media companies that allegedly commit a violation of this act.

(C)(1)–(2) A social media company that violates this act is liable to an individual for: 1. A penalty of Two Thousand Five Hundred Dollars ($2,500.00) per violation, court costs, and reasonable attorney fees as ordered by the court; or 2. Damages resulting from a minor accessing a social media platform without the consent of his or her parent or custodian, including court costs and reasonable attorney fees as ordered by the court.

(D)–(F) D. This section does not: 1. Apply to a news or public interest broadcast, website video, report, or event; 2. Affect the rights of a news-gathering organization; or 3. Apply to cloud service providers. E. No social media platform shall be liable under this act if, after performing reasonable age verification, a minor manages access to the platform through means of fraud including, but not limited to, the use of fake identification by the minor or an individual claiming to be the parent or legal guardian of the minor. F. An Internet service provider, or any of its affiliates or subsidiaries, or search engines will not violate this act solely when providing access, connection to or from a website, or other information or content on the Internet, or a facility, system, or network that is not under that Internet service provider's control, including transmission, downloading, intermediate storage, access software, or other service that provides access or connectivity, to the extent the Internet service provider is not responsible for the creation of the content or the communication on a social media platform.

Section 123 establishes the bill's enforcement framework and remedies. A social media company that knowingly violates the act is liable if it fails to perform reasonable age verification or fails to comply with Section 122's data-practice obligations. Upon completing age verification, the company must delete all identifying information. The Attorney General may initiate enforcement actions, and social media companies are liable to individuals for $2,500 per violation or actual damages, plus court costs and attorney fees.

Notable exemptions shield news and public-interest broadcasts, news-gathering organizations, and cloud service providers. A safe harbor protects platforms that performed reasonable age verification if a minor gained access through fraud, including use of fake identification. Internet service providers and search engines are also exempted when merely providing connectivity.

Compliance actions 1 item

Social media companies must not retain any identifying information of an individual after access to the social media platform has been granted following reasonable age verification.

D-01.4

25 O.S. § 124

Age-verification data retention limits for commercial entities

Deployer

(A) 12 A commercial entity or third-party vendor shall not retain any identifying information of an individual supplied for the purpose of age verification, except if required for audit and testing purposes, and in any case for no longer than thirty (30) days after access to the social media platform has been granted.

(B) A commercial entity that is found to have knowingly retained identifying information of an individual after access to the material is granted, except as provided for in subsection A of this section, is liable to the individual for damages resulting from the retention of the identifying information, including court costs and reasonable attorney fees as ordered by the court.

Section 124 imposes data-retention restrictions on commercial entities and third-party vendors that perform age verification. Identifying information supplied for age verification must not be retained, except where required for audit and testing purposes, and in any case for no longer than 30 days after platform access is granted. A commercial entity that knowingly retains identifying information beyond the permitted period is liable to the individual for actual damages plus court costs and attorney fees.

Compliance actions 1 item

Commercial entities and third-party vendors must not retain any identifying information supplied for age verification, except for audit and testing purposes, and in no case for longer than 30 days after platform access is granted.

D-01.9

Minor Safety Parental consent · controls · termination workflows

3 items

MN-01.11

Social media companies must prohibit Oklahoma minors under 16 from holding accounts on their social media platforms.

MN-01.2

Social media companies must obtain express parental or guardian consent before permitting an Oklahoma minor aged 16 or 17 to hold an account on their social media platform.

MN-01.1

Data Controls Data sale restrictions · deidentification

8 items

D-01

D-01.4

D-01

Social media platforms must not sell or share any personal information or geolocation data of minors.

D-01.4

Social media companies must not retain any identifying information of an individual after access to the social media platform has been granted following reasonable age verification.

D-01.9

Deceptive Conduct AI-generated likeness · consent requirements

1 item

CP-01.3

Passage Likelihood

High

Status Engrossed

Chamber Passed origin

Committee Passed

Majority party (No data)

Bipartisan No

Prior session None

Legislative History

2025-02-03 First Reading

2025-02-03 Authored by Representative Caldwell (Chad)

2025-02-04 Second Reading referred to Commerce and Economic Development Oversight

2025-02-04 Referred to Government Modernization and Technology

2025-02-05 Policy recommendation to the Commerce and Economic Development Oversight committee; Do Pass Government Modernization and Technology

2025-02-05 Authored by Senator Seifried (principal Senate author)

2025-03-10 CR; Do Pass, amended by committee substitute Commerce and Economic Development Oversight Committee

2025-03-24 General Order

2025-03-24 Coauthored by Representative(s) Lepak, Moore, Kendrix

2025-03-24 Amended

2025-03-24 Title stricken

2025-03-24 Third Reading, Measure passed and Emergency failed: Ayes: 64 Nays: 30; Ayes: 64 Nays: 30

2025-03-24 Referred for engrossment

2025-03-25 Engrossed, signed, to Senate

2025-03-25 First Reading

2025-04-01 Second Reading referred to Technology and Telecommunications

2025-04-17 Reported Do Pass as amended Technology and Telecommunications committee; CR filed

2025-04-17 Enacting clause stricken

2025-04-22 Placed on General Order

Sources

Full Text ↗

Entry Last Reviewed

2026-05-20

AI generated